Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 25 Sep 2023 11:26:12 GMT
From:      Fernando =?utf-8?Q?Apestegu=C3=ADa?= <fernape@FreeBSD.org>
To:        ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org
Subject:   git: e90a0b117fdc - main - security/vuxml: Add SA_ID to make newentry
Message-ID:  <202309251126.38PBQCrk094159@gitrepo.freebsd.org>

next in thread | raw e-mail | index | archive | help
The branch main has been updated by fernape:

URL: https://cgit.FreeBSD.org/ports/commit/?id=e90a0b117fdc61d6d6bc4b02a4b7b5be5a878b2d

commit e90a0b117fdc61d6d6bc4b02a4b7b5be5a878b2d
Author:     Fernando ApesteguĂ­a <fernape@FreeBSD.org>
AuthorDate: 2023-09-22 18:17:13 +0000
Commit:     Fernando ApesteguĂ­a <fernape@FreeBSD.org>
CommitDate: 2023-09-25 11:25:55 +0000

    security/vuxml: Add SA_ID to make newentry
    
    Automate registration of FreeBSD Security Advisories.
    
    It adds a new parameter for the newentry subcommand accepting a SA ID as present
    in the FreeBSD Security Advisories web page
    (https://www.freebsd.org/security/advisories/)
    
    Fills an entry following the common structure for FreeBSD SAs and leaves some
    "FIXME" strings in those places that need special care.
    Developers should NOT blindly trust the output of the script.
    
    `make newentry SA_ID=FreeBSD-SA-23:11.wifi.asc`
    `make newentry SA_ID=FreeBSD-SA-22:01.vt`
    
    Reviewed by:            philip@
    Differential Revision: https://reviews.freebsd.org/D41966
---
 security/vuxml/Makefile          |  2 +-
 security/vuxml/files/newentry.sh | 91 +++++++++++++++++++++++++++++++++++-----
 2 files changed, 81 insertions(+), 12 deletions(-)

diff --git a/security/vuxml/Makefile b/security/vuxml/Makefile
index d8305c85191a..3e5d1d98ab34 100644
--- a/security/vuxml/Makefile
+++ b/security/vuxml/Makefile
@@ -92,7 +92,7 @@ tidy: ${VUXML_FLAT_FILE}
 	${SH} ${FILESDIR}/tidy.sh "${FILESDIR}/tidy.xsl" "${VUXML_FLAT_FILE}" > "${VUXML_FILE}.tidy"
 
 newentry:
-	@${SH} ${FILESDIR}/newentry.sh "${VUXML_CURRENT_FILE}" ${CVE_ID}
+	@${SH} ${FILESDIR}/newentry.sh "${VUXML_CURRENT_FILE}" "CVE_ID=${CVE_ID}" "SA_ID=${SA_ID}"
 
 .if defined(VID) && !empty(VID)
 html: work/${VID}.html
diff --git a/security/vuxml/files/newentry.sh b/security/vuxml/files/newentry.sh
index 6da86b75a65b..58b2d874ec7e 100644
--- a/security/vuxml/files/newentry.sh
+++ b/security/vuxml/files/newentry.sh
@@ -2,22 +2,47 @@
 set -eu
 
 vuxml_file="$1"
-CVE_ID="${2:-}"
+CVE_ID=""
+SA_ID=""
 
-if [ -z "${vuxml_file}" ]; then
+show_usage() {
   exec >&2
-  echo "Usage: newentry.sh /path/to/vuxml/document"
+  echo "Usage: newentry.sh /path/to/vuxml/document [CVE_ID|SA_ID]"
   exit 1
+}
+
+if [ -z "${vuxml_file}" ]; then
+	show_usage
 fi
 
+shift
+while [ $# -gt 0 ]; do
+case "$1" in
+  CVE_ID=*)
+    CVE_ID="${1#CVE_ID=}"
+    shift
+    ;;
+  SA_ID=*)
+    SA_ID="${1#SA_ID=}"
+    shift
+    ;;
+  *)
+    echo "Invalid argument: $1"
+    show_usage
+    exit 1
+    ;;
+esac
+done
+
 tmp="`mktemp ${TMPDIR:-/tmp}/vuxml.XXXXXXXXXX`" || exit 1
+tmp_fbsd_sa=""
 tmp_mitre=""
 tmp_nvd=""
 
 doclean="yes"
 cleanup() {
   if [ "${doclean}" = "yes" ]; then
-    rm -f "${tmp}" "${tmp_mitre}" "${tmp_nvd}" > /dev/null
+	rm -f "${tmp}" "${tmp_fbsd_sa}" "${tmp_mitre}" "${tmp_nvd}" > /dev/null
   fi
 }
 trap cleanup EXIT 1 2 13 15
@@ -34,6 +59,14 @@ references="INSERT URL HERE"
 topic=""
 source="SO-AND-SO"
 upstream_fix=""
+impact=""
+DESC_BODY="<body xmlns=\"http://www.w3.org/1999/xhtml\">;
+	<p>${source} reports:</p>
+	<blockquote cite=\"${references}\">
+	  <p>${details}</p>
+	</blockquote>
+	</body>"
+
 
 # Try to retrieve information if a CVE identifier was provided
 if [ -n "${CVE_ID}" ]; then
@@ -49,7 +82,7 @@ if [ -n "${CVE_ID}" ]; then
 	# Get information from the NVD database JSON format
 	tmp_nvd="`mktemp ${TMPDIR:-/tmp}/nvd_json_data.XXXXXXXXXX`" || exit 1
 	fetch -q -o "${tmp_nvd}" https://services.nvd.nist.gov/rest/json/cves/2.0?cveId="${CVE_ID}" || exit 1
-	# Get information from MITRE database (they provide a nice "topic"
+	# Get information from MITRE database (they provide a nice "topic")
 	tmp_mitre="`mktemp ${TMPDIR:-/tmp}/mitre.XXXXXXXXXX`" || exit 1
 	fetch -q -o "${tmp_mitre}" https://cveawg.mitre.org/api/cve/"${CVE_ID}"
 
@@ -68,6 +101,47 @@ if [ -n "${CVE_ID}" ]; then
 	topic=$(jq -r ".containers.cna.title|@html" "${tmp_mitre}" ) || exit 1
 fi
 
+if [ -n "${SA_ID}" ]; then
+	SA_URL_BASE=https://www.freebsd.org/security/advisories/
+
+	# Get information from the Project's SA site
+	tmp_fbsd_sa="$(mktemp ${TMPDIR:-/tmp}/fbsd_sa_data.XXXXXXXXXX)" || exit 1
+	fetch -q -o "${tmp_fbsd_sa}" ${SA_URL_BASE}${SA_ID} || exit 1
+
+	# Create variables from SA note
+	if grep -q 'CVE Name' "${tmp_fbsd_sa}"; then
+		cve_tmp=$(grep 'CVE Name' "${tmp_fbsd_sa}" | cut -f2 -d:) || exit 1
+		cvename="${cve_tmp#"${cve_tmp%%[![:space:]]*}"}"
+
+		# NVD database only accepts uppercase CVE ids, like CVE-2022-39282, NOT
+		# cve-2022-39282.
+		cvename=$(echo "${cvename}" | tr '[:lower:]' '[:upper:]') || exit 1
+		cveurl="https://nvd.nist.gov/vuln/detail/${cvename}"
+	fi
+
+	details=$(awk '/II.  Problem Description/ {f=1;next;next} /III. Impact/ {f=0} (f==1) {print}' "${tmp_fbsd_sa}" ) || exit 1
+	details=$(echo "<p>${details}</p>" | fmt -p -s | sed -e 's/<p> /<p>/' | sed '1!s/^/\t/')
+	impact=$(awk '/III. Impact/ {f=1;next;next} /IV.  Workaround/ {f=0} (f==1) {print}' "${tmp_fbsd_sa}") || exit 1
+	impact=$(echo "<p>${impact}</p>" | fmt -p -s | sed -e 's/<p> /<p>/' | sed '1!s/^/\t/')
+
+	package_name="FreeBSD"
+	if grep -Eq 'Module:.*kernel' "${tmp_fbsd_sa}"; then
+		package_name="${package_name}-kernel"
+	fi
+
+	upstream_fix="FIXME"
+	references="${SA_URL_BASE}${SA_ID}"
+	source="The FreeBSD Project"
+	topic_tmp=$(grep 'Topic:' "${tmp_fbsd_sa}" | cut -f2 -d:) || exit 1
+	topic="${topic_tmp#"${topic_tmp%%[![:space:]]*}"}"
+
+DESC_BODY="<body xmlns=\"http://www.w3.org/1999/xhtml\">;
+	<h1>Problem Description:</h1>
+	  ${details}
+	<h1>Impact:</h1>
+	  ${impact}
+      </body>"
+fi
 
 awk '/^<\?/,/^<vuxml/ { print }' "${vuxml_file}" >> "${tmp}" || exit 1
 cat << EOF >> "${tmp}" || exit 1
@@ -80,12 +154,7 @@ cat << EOF >> "${tmp}" || exit 1
       </package>
     </affects>
     <description>
-      <body xmlns="http://www.w3.org/1999/xhtml">;
-	<p>${source} reports:</p>
-	<blockquote cite="${references}">
-	  <p>${details}</p>
-	</blockquote>
-      </body>
+	${DESC_BODY}
     </description>
     <references>
       <cvename>${cvename}</cvename>



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202309251126.38PBQCrk094159>